Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 06:37
Behavioral task
behavioral1
Sample
x.exe
Resource
win7-20240903-en
General
-
Target
x.exe
-
Size
3.1MB
-
MD5
ce560e01aa6d0a1848eacb577880f112
-
SHA1
ac6013ab7dec397c0f14368492047e5f54091f2c
-
SHA256
061f0c6e8d2aa06e218364b7d0f44e689d0c6b900a06844bf272efc516dabfdb
-
SHA512
988a405ec7c257c43e21ac721509478113c48ae5cdbfe25d7f0227a6ff473412ba662343365d4ca899fc621b6710437128505f29cb6939f45248ff255c4565ec
-
SSDEEP
49152:GvUt62XlaSFNWPjljiFa2RoUYI1EF3mMnAfvAoGd5THHB72eh2NT:GvI62XlaSFNWPjljiFXRoUYI1K3L
Malware Config
Extracted
quasar
1.4.1
su-pc
192.168.100.2:4444
47a88def-94f4-406d-86f5-8b0b767128df
-
encryption_key
6B74F0C858B7E90573D4E97997F2A082B9781250
-
install_name
x.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
x
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2792-1-0x00000000011C0000-0x00000000014E4000-memory.dmp family_quasar behavioral1/files/0x0032000000017474-6.dat family_quasar behavioral1/memory/2828-10-0x0000000000E00000-0x0000000001124000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2828 x.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\SubDir\x.exe x.exe File opened for modification C:\Windows\system32\SubDir\x.exe x.exe File opened for modification C:\Windows\system32\SubDir x.exe File opened for modification C:\Windows\system32\SubDir\x.exe x.exe File opened for modification C:\Windows\system32\SubDir x.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2824 schtasks.exe 2664 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2792 x.exe Token: SeDebugPrivilege 2828 x.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2828 x.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2824 2792 x.exe 30 PID 2792 wrote to memory of 2824 2792 x.exe 30 PID 2792 wrote to memory of 2824 2792 x.exe 30 PID 2792 wrote to memory of 2828 2792 x.exe 32 PID 2792 wrote to memory of 2828 2792 x.exe 32 PID 2792 wrote to memory of 2828 2792 x.exe 32 PID 2828 wrote to memory of 2664 2828 x.exe 33 PID 2828 wrote to memory of 2664 2828 x.exe 33 PID 2828 wrote to memory of 2664 2828 x.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "x" /sc ONLOGON /tr "C:\Windows\system32\SubDir\x.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2824
-
-
C:\Windows\system32\SubDir\x.exe"C:\Windows\system32\SubDir\x.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "x" /sc ONLOGON /tr "C:\Windows\system32\SubDir\x.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2664
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5ce560e01aa6d0a1848eacb577880f112
SHA1ac6013ab7dec397c0f14368492047e5f54091f2c
SHA256061f0c6e8d2aa06e218364b7d0f44e689d0c6b900a06844bf272efc516dabfdb
SHA512988a405ec7c257c43e21ac721509478113c48ae5cdbfe25d7f0227a6ff473412ba662343365d4ca899fc621b6710437128505f29cb6939f45248ff255c4565ec